LSA_CREATE_THREAD callback function (ntsecpkg.h)

Article
10/13/2021

The CreateThread function is a wrapper for the Windows CreateThread function that should be used by the Local Security Authority (LSA). It creates a thread that the LSA can track, attaches debugging information to threads it starts, and provides special exception handling to protect the LSA process.

Syntax

LSA_CREATE_THREAD LsaCreateThread;

HANDLE LsaCreateThread(
  [in]  SEC_ATTRS SecurityAttributes,
  [in]  ULONG StackSize,
  [in]  SEC_THREAD_START StartFunction,
  [in]  PVOID ThreadParameter,
  [in]  ULONG CreationFlags,
  [out] PULONG ThreadId
)
{...}

Parameters

[in] SecurityAttributes

Pointer to a SEC_ATTRS structure that determines whether the returned handle can be inherited by child processes.

[in] StackSize

Specifies the initial commit size of the stack, in bytes.

[in] StartFunction

Pointer to the application-defined function of type SEC_THREAD_START to be executed by the thread.

[in] ThreadParameter

Pointer to a single parameter value passed to the thread.

[in] CreationFlags

Specifies flags that control the creation of the thread.

[out] ThreadId

Pointer to a variable that receives the thread identifier.

Return value

If the function succeeds, the return value is a handle to the new thread. When you have finished using the handle, close it by calling the CloseHandle function.

If the function fails, the return value is NULL. To get extended error information, call GetLastError.

Remarks

A pointer to the CreateThread function is available in the LSA_SECPKG_FUNCTION_TABLE structure received by the SpInitialize function.

For more information, see the Windows CreateThread function.

Requirements

Requirement	Value
Minimum supported client	Windows XP [desktop apps \| UWP apps]
Minimum supported server	Windows Server 2003 [desktop apps \| UWP apps]
Target Platform	Windows
Header	ntsecpkg.h